80d28b14d2172c2a3a76a718b604d120ff2a8e80424d68790afbe0bd267ee064

Analysis

max time kernel
135s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChannelMgr.dll
Size

555KB
MD5

159080d668d047dbc7457c6e38905b12
SHA1

785018946914e05e7ffd6d0207920ebfb0ff6f70
SHA256

51d6636ec84888498f2abbc686aa20d0cef9ac0ab3eeb476363996941fb482e6
SHA512

f397b34da4d75f364edb7bff5e3a907eca2e0a04c2257a80f88c640fdb7f4884d07dae25fb9249b65ad91f20fd1839f765b77a3e79c84b3454a4038b956e4df5
SSDEEP

12288:EiYPmwEZQLHrx205aPMJ1oQPO9cKLchrAT:8EC6PMvoQPOz8AT

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral28/memory/4448-4-0x0000000002AD0000-0x0000000002BC8000-memory.dmp	vmprotect
behavioral28/memory/4448-3-0x0000000002AD0000-0x0000000002BC8000-memory.dmp	vmprotect
behavioral28/memory/4448-5-0x0000000002AD0000-0x0000000002BC8000-memory.dmp	vmprotect
behavioral28/memory/4448-10-0x0000000002AD0000-0x0000000002BC8000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

regsvr32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 regsvr32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2836 wrote to memory of 4448	2836	regsvr32.exe	regsvr32.exe
PID 2836 wrote to memory of 4448	2836	regsvr32.exe	regsvr32.exe
PID 2836 wrote to memory of 4448	2836	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ChannelMgr.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ChannelMgr.dll
2⤵
- Writes to the Master Boot Record (MBR)
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-2-0x00000000010E0000-0x00000000010F1000-memory.dmp

Filesize
68KB

Download
memory/4448-0-0x0000000002A20000-0x0000000002A70000-memory.dmp

Filesize
320KB

Download
memory/4448-4-0x0000000002AD0000-0x0000000002BC8000-memory.dmp

Filesize
992KB

Download
memory/4448-3-0x0000000002AD0000-0x0000000002BC8000-memory.dmp

Filesize
992KB

Download
memory/4448-5-0x0000000002AD0000-0x0000000002BC8000-memory.dmp

Filesize
992KB

Download
memory/4448-10-0x0000000002AD0000-0x0000000002BC8000-memory.dmp

Filesize
992KB

Download